Drop last --token hint; note sudo drops DRB_ENROLLMENT_TOKEN (node-26#18)

- key_pickup.py still told operators to re-run install.sh with --token.
- `curl | sudo bash` resets the env, so the documented exported-token
  path needs `sudo --preserve-env=DRB_ENROLLMENT_TOKEN`; say so.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -149,7 +149,8 @@ curl -fsSL https://git.vpn.cusano.net/logan/node-26/raw/tag/v1/install.sh \
 It prompts (hidden input) for an enrollment token, minted at **Settings → Nodes**
 in the web app. The token never goes on the command line — argv lands in shell
 history and `ps` (node-26#18). Unattended installs use `--token-file PATH` (mode
-0600) or an exported `DRB_ENROLLMENT_TOKEN`; the old `--token` flag still works
+0600) or an exported `DRB_ENROLLMENT_TOKEN` (pass it through with
+`sudo --preserve-env=DRB_ENROLLMENT_TOKEN`; plain `sudo` drops it); the old `--token` flag still works
 but warns. Run `install.sh --help` for every flag; each also has a `DRB_*` env
 var. `--build` compiles op25 on the Pi (~1h) instead of pulling.
 

drb-edge-node/app/internal/key_pickup.py

@@ -50,7 +50,7 @@ async def fetch_api_key() -> Optional[str]:
     if r.status_code == 401:
         logger.error(
             "Key pickup: C2 rejected the saved pickup secret (401) — it was rotated by a re-enroll elsewhere. "
-            "Re-run install.sh with --token to recover."
+            "Re-run install.sh and give it a fresh enrollment token when it asks (node-26#18)."
         )
         return None
     if r.status_code == 404:

install.sh

@@ -144,6 +144,8 @@ DRB_MQTT_BROKER, DRB_REF, DRB_INSTALL_DIR, DRB_REGISTRY_USER/PASS, ...
 Secrets are read from a file, the environment or a TTY prompt, never from a
 pipe. Never put the token on a command line: `--token X` and
 `sudo DRB_ENROLLMENT_TOKEN=X bash` both expose it in shell history and `ps`.
+An exported DRB_ENROLLMENT_TOKEN only reaches the installer through sudo with
+`sudo --preserve-env=DRB_ENROLLMENT_TOKEN bash` (plain sudo drops it).
 (`--token` still works for old copied commands but is deprecated, see node-26#18.)
 USAGE
 }